The DMZ

David Freitag

01:01

Yup officially can't wait to be out of this apartment.

Mark Buffalo

01:19

Happy for you, @DavidFreitag

David Freitag

@MarkBuffalo I'm not out yet...

Mark Buffalo

Still, it's almost time

David Freitag

I'm moving tomorrow but the power doesn't get turned on until monday, and the internet doesn't get turned on until thursday

Mark Buffalo

Ah, shitty.

David Freitag

Still take that over this place

Mark Buffalo

01:20

Luls

It's that bad?

I hope we can buy a house in a month and a half

So as long as nobody buys ours

And by "ours," I mean the one we're looking at.

David Freitag

Why do you have to wait a month?

Mark Buffalo

Tax refund, plus a month's worth of wages

David Freitag

Yeah but you can put a deposit down though can't you?

Mark Buffalo

Down payment requires tax refund and one month of wages due to moving debt

David Freitag

wut

Mark Buffalo

01:36

We spent all our savings getting here

David Freitag

From where?

Mark Buffalo

Vegas

So now we're finally ahead again, and can buy a house again.

Terry Chia

02:27

@RоryMcCune Yeah, you have more docker experience than I have. ;)

David Freitag

@TerryChia Not because you're super into docker, but because you and @AviD are hipsters

Terry Chia

@DavidFreitag Yeah but @RоryMcCune writes Ruby. Ruby is more hipster than Python...

David Freitag

@TerryChia Python is more hipster than C

Mark Buffalo

03:12

He's a Ruby Artist? Roflage.

David Freitag

Ruby art?

Mark Buffalo

I refer to anyone who is good at something as an artist

David Freitag

Right...

Mark Buffalo

But sometimes it could be said in derision

Like right now.

ROFL @ RUBY ON RAILS

Kidding... I should learn it.

David Freitag

What's wrong with RoR?

Mark Buffalo

03:15

@DavidFreitag Are you playing the thing?

EVE?

David Freitag

@MarkBuffalo No been packing nonstop

Just taking a quick breather break

Mark Buffalo

ah

I'm playing King's Bounty: Warriors of the North

I love King's Bounty as a series

David Freitag

Never heard of it

Mark Buffalo

04:36

Check it out on steam

It's an open-world turn-based strategy rpg thing.

Bob Ebert

05:08

Hey guys, I have a directory traversal question

Am I right to say that I must know the files names in order to view them?

Or there is a way to list them

I did not find documentation about it (so I guess you have to know the file name)

Mark Buffalo

06:17

@schroeder Hai

thinking of going for the CISSP

@RоryMcCune @RoryAlsop etc, any recommended study materials?

Iszi

08:00

I love it when something so seemingly simple (relatively speaking) suddenly turns into nuclear apocalypse when you hand it over to Randall Munroe for a realistic analysis. what-if.xkcd.com/147

AviD

09:20

@diagprov hahaha

was that you?

@Iszi his style of realistic yet fatalistic analysis really gets my 10 year old interested in sciences.

cant beat huge explosions.

@RоryMcCune hahaha, so di you raise your hand and explain to him why he's talking crap?

or didja go easy on him cuz its a student, on stage for the first time....

btw @RоryMcCune how did your talk go?

ya damn hipster

@diagprov Ha. ha. frikkin. ha.

@diagprov @TildalWave actually, I had originally asked the question on SO. It went nuclear, unix neckbeards viciously attacked in droves, eventually mods had to delete the question (because yes, it was that bad). Eventually I re-asked here, a bit more sane...

some of the SO bunch trickled back in here, where I weilded my diamond in defense of sanity - though a bit too indiscriminately, apparently... @diagprov got hit by my scattershot, he laid the smackdown, thats when @neil got me to apologize.

Profusely.

@RоryMcCune you should do a talk where you respond to twitter trolls in realtime.

@kalina you get backstabbing and hate in here??

Rory Alsop

10:08

Morning. Wow - temperature went up 12 degrees while I was in the gym this morning

Rory Alsop

10:30

@MarkBuffalo not really. It used to be cccure.org, but it's been too long since I looked into it. Had my CISSP for ten years and ditched it 3 years ago

AviD

11:03

@RoryAlsop some would say, that is not a coincidence

@RoryAlsop I used that site too. Had it for 6, ditched 4 ago

Terry Chia

11:21

@AviD So @RoryAlsop had it for longer but you ditched it earlier. Who won?

AviD

I did. he had it for longer.

Rory Alsop

Length isn't everything... Apparently

2

@AviD I may be hot, but I'm not that hot :-)

AviD

even in the gym...?

@RoryAlsop starwhore.

Rory Alsop

Starwhere

Starwhen

Starwho

Starwhich

Star witch

Coffee has kicked in

Rory Alsop

11:57

gallifreyan-9000.rhcloud.com/#RORY

@Rоry in Gallifreyan

I prefer the result of The Insidious Doktor Mayhem...

TildalWave

@AviD somehow, that SE is just as profoundly insane as the rest of the world, comforts me... at least I can rest assured the world won't be saved by morons

I meant SO

Rory Alsop

12:17

SO is possibly much more insane...

TildalWave

well, it's a religion, so it would be

Terry Chia

Anyone have experience with this? github.com/google/grr

@RoryAlsop, @AviD, @LucasKauffman, @tylerl etc

Rory Alsop

12:46

@TerryChia ... Remote is a problem

If I'm carrying out forensics I need a probable chain of custody

AviD

@TerryChia not even a little

Rory Alsop

Remote instantly breaks that

AviD

@RoryAlsop ah so I've discovered that "forensics" is often used in two very different meanings

Rory Alsop

Provable, not probable

AviD

one is the classic, legal definition you're familiar with, the other is more properly known as IR or investigation...

Terry Chia

12:52

I think this is more a IR type thing. System monitoring and all that.

Rory Alsop

All forensics I have ever done has been for large enterprises, so may need to go to court

AviD

somehow some people still call the latter "forensics" even though it is clearly not

Rory Alsop

It is still IR

AviD

@RoryAlsop sure, but different type

not all IR is forensics

TildalWave

did you just say that not all response needs to relate to cause?

Rory Alsop

12:55

@AviD - think because I have only done large corporate, I only saw strict forensic IR

AviD

@TildalWave wut?

Rory Alsop

^ what he said ... Wut

AviD

@RoryAlsop even in large corporates, sometimes they say forensics but dont mean the legal term.

its what happens when regular sysadmins or other techies think they know everything about all kinds of tech.

TildalWave

5 mins ago, by Rory Alsop

If I'm carrying out forensics I need a probable chain of custody

how is this irrelevant to IR?

AviD

@TildalWave the other way around

it is a very specific subset of IR

actually, its not always IR

@TildalWave also still, wut

TildalWave

12:58

OK, let me rephrase ... takes a deep sip of coffee ... when you're doing IR, you consider that as a separate process to investigation?

AviD

ooh didnt have coffee today :-(

maybe will go for redbull instead, too late to start with hot coffee

@TildalWave forensics? it is a different set of requirements.

Mark Buffalo

@RoryAlsop what did you go after instead of CISSP?

AviD

therefor different process, different toolset.

TildalWave

@AviD OK; then I understand what you're saying

Mark Buffalo

@AviD Why did you ditch CISSP?

AviD

13:00

@MarkBuffalo too much bother, waste of time.

Mark Buffalo

I get the feeling I could pass CISSP without studying

AviD

I mean, I usually have plenty of CPEs, but keeping track of them and reporting them is too much of a pain.

plus like hunnered dollahs each year...

and overall, I didnt see that I get any value out of it.

If I were competing for gov't type jobs, or big corporate gigs, it might matter (maybe), but I dont take those anymore anyway.

Mark Buffalo

@AviD isnt' that like $4000 in jewish rupees?

AviD

also, they still keep wanting me anyway, so even if I did want, I wouldnt need the CISSP

@MarkBuffalo hehwut

was that a #simonism?

Mark Buffalo

yes

I'm just messing with you bro

AviD

13:04

heh

Mark Buffalo

apologies if that offended you

TildalWave

oh we'll be offended just to take your apology

wot?

this coffee sucks!

AviD

@MarkBuffalo what did?

Mark Buffalo

the jewish rupee joke

obviously it's a shekel or dinar or something

that reminds me. I used to play a game with this guy who said in the future, my descendants will be slaves of his lineage, and that we're all goyim or something

he was hilarious, but then it turned out he wasn't kidding

I miss him :(

AviD

@MarkBuffalo sorry not seeing what should be offensive here

I think I might just be lacking that gene

@MarkBuffalo lol

Mark Buffalo

13:22

@AviD some folks are sensitive to light jesting

AviD

@MarkBuffalo I woiuldnt know anything about that

but this collegehumor.com/post/7036038/…

Rory Alsop

@MarkBuffalo got my CISM from ISACA, then Member of the Institute of Information Security Professionals from IISP, then C|CISO from EC|Council, then CRISC from ISACA.

CISSP was useful when a consultant. Gives me nothing now

Terry Chia

@RoryAlsop Yeah, why would HR managers require CISSP amirite?

Rory Alsop

@TildalWave I don't get it. What do you mean?

@TerryChia - still has value I think for some of our junior folks. But then we also look at CSX and C|EH for new junior hires

@TerryChia and "hahahaha"

Harrumph

Terry Chia

@RoryAlsop Oh, I thought you didn't get it. :P

TildalWave

13:50

@RoryAlsop I thought he was talking of one single process where IR is a part of forensic investigation

basically, I was coming from the description of that Grrrr which can be read as if it's promising both at the same time

remotely

AviD

@TildalWave nah, it seemed like that Grrrrr was talking about IR, but not "proper" forensics.

TildalWave

yeah and I've read too much into it

Mark Buffalo

@RoryAlsop CEH/CISSP = hahahahahahhaaha?

TildalWave

mind, I'm probably still functioning on fumes of alcohol from yesternight

Mark Buffalo

Okay, it looks like I will need CISM, CCISO, andCRISC

I personally think certs are stupid... but

Rory Alsop

13:54

@MarkBuffalo CEH for new grads + very helpful. CISSP for those a couple of years into their careers + pretty good actually

@MarkBuffalo CRISC - very useful if you want to have a career in technology risk

CISM - similar for security management

CCISO - useful later in your career

(did you see my presentation on this sort of thing?)

@MarkBuffalo agreed - but useful for certain things

because HR

Mark Buffalo

Yeah, that's it

TildalWave

Rory Alsop: Starting your Security Career - Where can you go?

►

this one?

Mark Buffalo

Because HR

I saw it, but no captions, so I can't get anything from it

TildalWave

LOL

Mark Buffalo

@RoryAlsop 99.9% of what I know about information security is from breaking it, and trying to find ways to prevent it from being broken

diagprov

13:58

@AviD Nope, it was not me. I tend to take "needs fluent German" literally.

Rory Alsop

Stack Exchange Security Blog: Presentations: Starting your security career – where can you go?

roryalsop on March 28, 2013

I gave a talk on career planning in Information Security at Abertay University on the 16th of January 2013.

Securi-Tay is an annual security conference organised by students at Abertay and is a very well organised and run event – could put some professional conferences to shame!

Video of my talk

The talk went down very well, with a lot of discussion spinning off afterwards, and the odd additional visitor to Sec.SE

Most of the video should be straightforward, but a couple of the slides may be hard to read so I have included them here: …

this has some info

Mark Buffalo

I think my path is totally different

Great, thank you

diagprov

@AviD Correct, armies of neckbeards swarmed and tigger was forced to call in reinforcements in the form of Winnie and Piglet.

AviD

LOL

Rory Alsop

@MarkBuffalo mine was IT, sys and network admin, then ending up breaking and fixing things, and securing stuff more and more. Fell into security, then sidestepped into risk

AviD

13:59

@diagprov I would watch that movie

the gritty remake of Tigger movie.

Rory Alsop

@AviD best seller at the box office

Mark Buffalo

@RoryAlsop lol

Rory Alsop

@MarkBuffalo oh, and then took up HR as a hobby, obviously

Mark Buffalo

Yeah, I've done networking, sys admin, it (hardware), programming, databases, breaking/fixing

diagprov

@AviD Nobody in their right mind is going to let me direct a movie.

AviD

14:02

@diagprov do it in German.

Mark Buffalo

@RoryAlsop haha, but with all your experience, you'd be the right person in HR

diagprov

@AviD Richtig, Armeen von neckbeards wimmelte und Tigger wurde in Verstärkungen in Form von Winnie und Piglet nennen gezwungen.

I'm guessing Google Translate mangled that quite badly.

AviD

heh, looks pretty good

at least on reverse-google-translate back into english

tbf that doesnt always work

diagprov

@AviD Does it always work then, "נכון, צבאות neckbeards נהרו ונאלץ טיגר להתקשר תגבורת בצורה של פו וחזרזיר"

AviD

yeah that does not reverse well

also the hebrew is pretty bad

diagprov

14:08

I figured as much, I learnt a bit of Bulgarian and GT produces the most awful Bulgarian ever.

TildalWave

@RoryAlsop looking at it again, I kinda thought you're gonna say Frank Abagnale there were you mention Mitnik... but I guess I'm old LOL

AviD

@diagprov it works pretty well for a single word, or small set of words at a time. But it usually doesnt give you proper grammar or sentence structure

I find it very useful to translate FROM a language I dont know, so even if the english is horrid, I can still get an idea what they mean

TildalWave

@diagprov unless you start with a language that's "compatible" in terms of structure and grammar

I can just use my language as input to translate to Bulgarian, it works pretty well

from English or German, yeah it just doesn't work

@AviD but how do you get around the fact that some sentences will have an opposite meaning if word order is reversed?

possessive forms are especially tricky

AviD

14:32

@TildalWave true

Rory Alsop

14:47

@TildalWave I probably need to update it.

Think I can put up some of my slides from Friday. Will do that on the blog soon if I remember

diagprov

@AviD Yeah it's handy for that purpose

Rory Alsop

@diagprov and it's good for writing silly songs...

Not that I ever did that...

Ahem

Oh - very impressed. One of my team has just published her first novel of a trilogy. And it's pretty good! I proofread it. I'd recommend it for young adults who like this kind of story :-)

bookguild.co.uk/bookshop-collection/childrens/teens-young-adult/…

TildalWave

@RoryAlsop it's an interesting talk but I can't help to wonder where you think I'd stack up on those slides of yours :)

I'd be probably offered a broom LOL

Rory Alsop

That's actually a difficult question here. This site lets you find out a lot about people in specific areas they want to share info about. So I honestly don't know. Obviously we have have deep specialists like the bears etc, and generalists, and management, and Simon...

In principle though, if someone gets to interview and I feel they have something to bring then I'm happy. Degree is proof of ability to learn. Certs are a demonstration of interest and application. But nothing beats talking to someone

Asking them examples of what they have done or how they would approach something

TildalWave

15:04

yeah I'm kinda sidetracking your slides there with a bit of everything and yet alongside it in parallel ... you didn't really touch developer aspect much, or risk management,...

Rory Alsop

Oh, that talk was to an audience mostly made up of students of ethical hacking. I did a more varied one for ISACA that month :-)

TildalWave

I'd be interested to see it then

Rory Alsop

Don't think risk is even on the radar of those students. It's a really difficult sell at that stage

TildalWave

frankly, I'm a bit of an oddball anyway

Rory Alsop

DMZ denizen, we call it

TildalWave

15:06

no I mean professionally :P

I can't even define it myself really, I guess the easiest would be to say I'm a researcher, but what of is another matter LOL

not this kind of researcher ...

@TildalWave: cdn2b.video.pornhub.phncdn.com/videos/201406/18/28303281/… --------- If you can find info about the cdn from this URL, please use it. As you can see, My public ip address is being shown in the URL. Monkeying around with the parameters after the URL results in failure. What things are at play here? — Spandan 11 hours ago

tho that's easy :)

should probably be deleted, the guy is giving away his IP

and that he likes to watch vagina documentaries LOL

@RoryAlsop so you think risk management is more of an engineering branch?

I kinda found myself in the middle of it through developing in GIS, that's quite a while ago tho

TildalWave

15:30

@RoryAlsop So let's say for generalists, how much space there really is for people like that in a corporate environment, and still keep doing things in infosec more than, say, advertising, management,...?

Rory Alsop

@TildalWave no, not an engineering branch, but I have best results when I find people who have IT background, plus risk management, plus governance and oversight, plus maybe audit...

TildalWave

fair enough, so I guess that partially also answers my other question

risk management is in my experience inherently interdisciplinary and even knowledge in things like maths, statistics and economy will help a great deal

and management of course, but that's already implied in the name

I've never really seen anyone with a job position of a risk manager tho, and even tho I was doing it, I also was officially something else.... it almost seems like some niche thing, yet it isn't. Which all I find kinda curious. Do corporations actually seek risk managers, or is that something you just end up doing while holding onto some other job title?

I was basically a CTO back then

Rory Alsop

15:54

Apologies for intermittent comms. 19 miles today driving kids to 7 different sports/exams/events

Financial organisations explicitly hire risk managers, yes

We have maybe 300 under operational risk, covering conduct risk, technology risk, regulatory affairs etc

I'm sort of a senior risk manager

We have entire career progressions defined in this space

Allk reporting up to Chief Risk Officer

Mark Buffalo

16:45

work is a 40 mile commute for me :D

slits wrists

@RoryAlsop Risk this, risk that. What is it all about?

There seems to be risk sub-professions in nearly every profession

Rory Alsop

@MarkBuffalo eh, y'know, risky stuff, and that

@MarkBuffalo well, it defines how much capital you need to carry in order to exist. The riskier your profession, the bigger the win (possibly) but the bigger the potential loss, so you need to budget for it. A good risk function allows you to reserve only what you need to manage your risk appropriately

Mark Buffalo

ah, ok. this is a BA/MBA thing, then

so you are doing that as well as IT security? That's pretty good

Rory Alsop

@MarkBuffalo erm...I don't know what that means

@MarkBuffalo I own my company's Information Security risk - which means I make an opinion on what we are doing to secure ourselves, our risk appetite in all parts of the organisation, our projected threats, and decide where we need to spend more money, or less, on security

diagprov

@RoryAlsop I think he's referring to reserve capital required for lending.

Mark Buffalo

@RoryAlsop Business Administration / Master of Business Administration

In those degree courses, they go into Risk Management very heavily... and there's even this entire sub-profession thing dedicated to it

Rory Alsop

16:57

@diagprov ah - I don't know about that

Mark Buffalo

Seems like you've figured it out without having to take the courses, though

:b

Rory Alsop

@MarkBuffalo I knew what the letters mean, but those don't really help with what I do. I looked into the MBA quite heavily, and the only benefit I could find was networking with senior folks

TildalWave

@RoryAlsop ah you see that's business analytics / intelligence ... i.e. it's assessing financial risk ... I was thinking more what you said later what you do

diagprov

@RoryAlsop Very simply put it's a similar idea. Lending money is risky, as is borrowing it and you expect a certain amount of default on lending. That costs you money, so you need to hold some for this eventuality and also to convince everyone else to lend you money.

Rory Alsop

@TildalWave yeah - there is the whole Basel II stuff etc., but I am not interested in that

@diagprov it's not one of my interest areas at all :-)

diagprov

16:59

In the IT world - IT has risks, risks involve litigation and fines, so money is set aside for it.

Rory Alsop

@diagprov yep - that's what I do

Mark Buffalo

0

Q: Determine the password space

(Determine the precise password space for valid passwords) The criteria for passwords you should consider are: Passwords will be set to a minimum of 15 characters. Passwords require at least two characters from all four categories: At least two (2) lowercase letters (a, b, c, . . . ) At leas...

The pony ponying.

Rory Alsop

(not so much the worry about litigation and fines - those are just numbers so we add 'em to the plan)

diagprov

@RoryAlsop My family are mostly all in finance, so I know more about this than I really have a right to know.

Transcript for